Intune Security Baseline Audit for Windows 11: How to Find Drift From the Baseline You Deployed

The short version: An Intune security baseline audit answers one question: is the Windows baseline you deployed still the configuration your Windows 11 devices actually run? Drift comes from four places: per-setting conflicts with other policies, devices that never received the baseline, customised values nobody wrote down, and a profile left on an old version after Microsoft published a newer one. Each is visible in the Intune admin center if you know where to look.

Most organisations that use Intune assigned the Windows security baseline once, saw a healthy-looking status chart and moved on. That is a reasonable starting point. The trouble is that a baseline is a snapshot of Microsoft's recommendations at the time of its version, applied on top of every other policy you have written since. An Intune security baseline audit is the periodic check that the snapshot, the policies around it and the devices underneath still agree.

This article explains how to run that check on Windows 11: where the status reports live, how to read a conflict, how to tell whether your profile is out of date, and what an independent audit adds. It assumes you already use Intune; if you are still deciding which Intune licence to buy, our guide to Intune Plan 1, Plan 2 and the Suite covers that first.

What is the Intune security baseline, and what is it not?

In the Intune admin center, under Endpoint security and then Security baselines, Microsoft publishes preconfigured groups of settings for Windows, Microsoft Defender for Endpoint, Microsoft Edge, Windows 365 and Microsoft 365 Apps. The one most organisations mean by "the baseline" is the Security Baseline for Windows 10 and later. Microsoft's documentation describes these baselines as its recommended configuration, built from the same guidance as its Group Policy security baselines, and lists every default value on a reference page per version.

Three things it is not, because each one is a common assumption in audit findings.

• It is not the CIS benchmark. The Center for Internet Security publishes its own benchmark for Windows 11 managed through Intune. It overlaps heavily with Microsoft's baseline but is not identical, and a device that matches one can fail items in the other. If a customer, an insurer or an assessor asks about CIS, the Microsoft baseline is not the answer by itself.
• It is not a compliance policy. A baseline configures settings. A compliance policy evaluates a device against a short list of conditions and marks it compliant or not, which Conditional Access can then act on. A device can be compliant while half its baseline settings are in conflict.
• It does not update itself. When Microsoft publishes a new baseline version, existing profiles stay on the version they were created with until an administrator updates them.

Where does drift come from?

In our experience reviewing Microsoft 365 tenants, drift from a deployed baseline almost always has one of four causes.

Conflicts with other policies

The most common source. Someone creates a settings catalog profile, an endpoint security policy or an older device configuration profile that sets the same setting the baseline sets, to a different value or even to the same value. Intune then cannot decide which applies, and the setting reports as a conflict on that device. Nothing is broken in a visible way, but the device is running whichever value it last received, which is not necessarily the one you intended.

On hybrid-joined devices that still receive Group Policy, the same setting can also be set by a GPO. Windows has a policy, MDMWinsOverGP in the ControlPolicyConflict area, that tells the device to prefer the MDM value where both exist. Whether it is set is worth recording, because without it the answer to "which value wins?" depends on the setting.

Devices that never got the baseline

A baseline applies to the groups it is assigned to. Devices outside those groups, devices enrolled after a group was restructured, and devices excluded "temporarily" for a project two years ago all run without it. The status chart only counts devices the baseline was assigned to, so it cannot show you what is missing.

Customised values nobody wrote down

When you create a baseline profile you can change any default. Most tenants have a handful of changes: a setting relaxed because a line-of-business application broke, a prompt switched off because staff complained. Each one may be correct. The problem is that, a year later, nobody can say which values were deliberate and which were a test that was never reverted.

A profile left on an old version

Microsoft publishes new versions of the Windows baseline as Windows and its guidance change; recent versions have been named after Windows releases such as 23H2 and 24H2. A profile created on an older version keeps that version's settings. Microsoft's documentation explains that updating a profile creates a new instance on the latest version, side by side with the original, and lets you choose whether to carry your customisations across. The original stays as it was, which is why Microsoft also tells you to remove the original's assignments, or you create the very conflicts you were trying to avoid.

How do you check each of these in the Intune admin center?

You can do most of this yourself in an afternoon for a small estate. Allow for reporting delays: Microsoft notes that status data can take up to 24 hours to appear after a baseline is first assigned, and up to six hours after a change.

1. List the baseline profiles and their versions. Go to Endpoint security, then Security baselines, and open the Security Baseline for Windows 10 and later. Each profile shows the version it was created from. Note any profile that is not on the latest version, and any tenant with more than one Windows baseline profile assigned to overlapping groups.
2. Check assignments and exclusions. For each profile, open its properties and write down the included and excluded groups. Then compare the total number of Windows devices in Intune with the number the baseline reports on. The difference is your coverage gap.
3. Read the status by setting, not just by device. The device status view shows how many devices report success, error, conflict or not applicable. The per-setting view is where the useful detail is: it shows which individual settings are in conflict or error, and on how many devices.
4. Trace every conflict to its other policy. Open an affected device, go to its device configuration view, and look for the other profile that sets the same setting. Decide which policy should own that setting and remove it from the other one. Do not resolve conflicts by excluding devices from the baseline; that turns a visible conflict into an invisible coverage gap.
5. Record every customised value. Open the profile's settings and note each value that differs from Microsoft's default for that version. For each one, write down why it was changed and who agreed to it. Microsoft's reference page for the version lists the defaults to compare against.
6. Spot-check a device directly. On a Windows 11 device, Settings, then Accounts, then Access work or school lets you export a management diagnostic report. It shows the policies the device actually received, which is the final word when the console and the user disagree.

How do an audit, the status report and a CIS scan compare?

These three get confused, and they answer different questions.

Status report, baseline audit or CIS benchmark scan?

• The baseline status report. Built into Intune, current to within hours, and accurate about what it covers: assigned devices, measured against the values in your own profile. It does not tell you the profile is out of date, that devices are missing from the assignment, or whether a customised value was a good idea.
• A baseline drift audit. A point-in-time review of the profile versions, assignments, customisations and conflicts, with each finding traced to its cause and a recommended owner for each contested setting. It covers what the status report cannot see, and produces a document someone outside IT can read.
• A CIS benchmark scan. Measures devices against an external benchmark rather than against your own intent. Useful when a customer contract, insurer or assessor names CIS. It will flag items that Microsoft's baseline sets differently, and those need a decision rather than an automatic fix.

What does an independent audit add?

The value is less in the reading of reports, which your own team can do, and more in the judgement around them. An independent review asks why a setting was customised, whether a conflict was deliberate, and whether the baseline's assignment still matches the way the organisation is structured now.

Brocent's Intune device audit covers the baseline alongside enrolment, compliance, encryption, Defender, update rings and app protection. It is a read-only review: a Global Administrator approves a read-only application once, and settings that no API exposes are reviewed on a screen share with your IT lead. Our article on what an Intune device audit checks explains the full scope, and the sample Intune device audit report shows the output for a fictitious firm, including how baseline findings are graded and placed in a phased fix plan.

For the baseline specifically, the report records the baseline type and version checked, the assignment and coverage gap, every customised value with the reason given, every conflict with the policy on the other side, and a recommendation on version updates. Where a client wants a CIS comparison, the report shows the CIS result separately, so the two are never presented as the same thing.

The device audit is usually scoped together with the tenant-wide review. The Microsoft 365 security audit pricing page sets out the fixed headcount bands, from US$450 for up to 10 users, and the 5 to 7 business day turnaround. If the outcome is that you want ongoing device management rather than a one-off check, Brocent's MDM and BYOD management service covers that, and the Microsoft Intune pricing page covers licences.

For teams in the UK, the baseline maps naturally onto the secure configuration requirement in Cyber Essentials. For teams in Australia, it supports the configuration and patching questions that most cyber-insurance proposals ask. In both cases the audit report is designed to be used as evidence; it does not grant certification or cover.

What usually goes wrong after an audit?

A few patterns are worth knowing before you start fixing.

• Updating the version in one step. A new baseline version can change defaults that your applications depend on. Assign the updated profile to a pilot group first, watch for a week, then move the rest of the estate and remove the old profile's assignments.
• Resolving conflicts by deleting the baseline setting. It is tempting to clear a conflict by removing the setting from the baseline. Usually the other policy is the one that should give way, because the baseline is the documented reference.
• Leaving exclusions open. Every exclusion group should have an owner and a review date. Without one, a temporary exclusion becomes permanent.
• Mixing baselines that overlap. The Windows baseline and the Defender for Endpoint baseline touch some of the same areas. Decide which owns each overlapping setting, rather than assigning both to every device and accepting the conflicts.

Frequently asked questions

Is the Intune security baseline the same as CIS for Windows 11?

No. Microsoft's baseline is Microsoft's own recommended configuration. CIS publishes a separate benchmark for Windows 11 through Intune. They overlap, but a device can pass one and fail items in the other, so name the one you are measuring against.

Does Intune update the security baseline automatically?

No. Existing profiles stay on the version they were created with. Updating creates a new instance on the latest version alongside the original, and you choose whether to keep your customisations. Remove the original profile's assignments afterwards to avoid conflicts.

What does "conflict" mean in the baseline report?

That two policies apply the same setting to the same device and Intune cannot resolve which should win. The fix is to decide which policy owns the setting and remove it from the other.

How often should we audit the baseline?

At least once a year, and whenever Microsoft publishes a new baseline version, you restructure device groups, or you add a significant new configuration policy. Quarterly is reasonable for organisations that change policies often.

Can we exclude a device from the baseline to fix a problem?

You can, but record the reason, the owner and a review date. An excluded device is invisible in the baseline's status chart, so exclusions are where drift hides.

Does a baseline audit change anything on our devices?

Not ours. The review is read-only. Changes are made by your team or by a provider you engage afterwards, following the fix plan.

Where to start

Open the Windows security baseline in the Intune admin center this week and write down three numbers: the profile's version, the number of devices it reports on compared with the number of Windows devices in Intune, and the number of settings in conflict. If any of the three surprises you, the baseline has drifted. If you want someone outside your team to do the full review and hand back a ranked fix plan, talk to a consultant.